Code:
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8071381ebb7, The address that the exception occurred at
Arg3: ffffd28f00c4f1e8, Exception Record Address
Arg4: fffff80710284900, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for Netwtw08.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 2186
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 10133
Key : Analysis.Init.CPU.mSec
Value: 358
Key : Analysis.Init.Elapsed.mSec
Value: 3377
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8071381ebb7
BUGCHECK_P3: ffffd28f00c4f1e8
BUGCHECK_P4: fffff80710284900
EXCEPTION_RECORD: ffffd28f00c4f1e8 -- (.exr 0xffffd28f00c4f1e8)
ExceptionAddress: fffff8071381ebb7 (nt!ExpInterlockedPopEntrySListFault)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff80710284900 -- (.cxr 0xfffff80710284900)
rax=0000000c0d35004e rbx=00000000c0000001 rcx=fffff80732bd10a0
rdx=bfffd58b417dbfd0 rsi=fffff80732bd0fc0 rdi=ffffd28f00c4f560
rip=fffff8071381ebb7 rsp=ffffd28f00c4f420 rbp=00000000000000e8
r8=bfffd58b417dbfd0 r9=0000000054685749 r10=fffff80732bd10a0
r11=0000000000000008 r12=fffff80732b93428 r13=ffffa180e6eee800
r14=00000000000000ec r15=ffffd58b55345050
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
nt!ExpInterlockedPopEntrySListFault:
fffff807`1381ebb7 498b08 mov rcx,qword ptr [r8] ds:002b:bfffd58b`417dbfd0=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80714105450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffd28f`00c4f420 fffff807`32759d1a : 00000000`00000000 ffffd58b`558b8000 ffffd58b`55345050 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault
ffffd28f`00c4f430 00000000`00000000 : ffffd58b`558b8000 ffffd58b`55345050 00000000`00000000 ffffd28f`00c4f560 : Netwtw08+0x129d1a
SYMBOL_NAME: Netwtw08+129d1a
MODULE_NAME: Netwtw08
IMAGE_NAME: Netwtw08.sys
STACK_COMMAND: .cxr 0xfffff80710284900 ; kb
BUCKET_ID_FUNC_OFFSET: 129d1a
FAILURE_BUCKET_ID: AV_Netwtw08!unknown_function
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a952742b-cdaa-1618-647d-b14a244b91d9}
Followup: MachineOwner
Code:
For analysis of this file, run !analyze -v
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000004477, A driver tried to write to an unallocated address in the
user space of the system process. Parameter 2 contains the
address of the attempted write.
Arg2: 0000000000040202
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2562
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7465
Key : Analysis.Init.CPU.mSec
Value: 327
Key : Analysis.Init.Elapsed.mSec
Value: 2146
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 4477
BUGCHECK_P2: 40202
BUGCHECK_P3: 0
BUGCHECK_P4: 0
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffffa05c3b0f6d0 -- (.trap 0xfffffa05c3b0f6d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000103 rbx=0000000000000000 rcx=0000000000040202
rdx=ffffc10fdeef5040 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8053b4d154c rsp=fffffa05c3b0f860 rbp=0000000000000080
r8=ffffc10fdeef5040 r9=000000000000002f r10=ffffffffffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KeRemovePriQueue+0x24c:
fffff805`3b4d154c 0001 add byte ptr [rcx],al ds:00000000`00040202=??
Resetting default scope
MISALIGNED_IP:
nt!KeRemovePriQueue+24c
fffff805`3b4d154c 0001 add byte ptr [rcx],al
STACK_TEXT:
fffffa05`c3b0f228 fffff805`3b69d630 : 00000000`0000001a 00000000`00004477 00000000`00040202 00000000`00000000 : nt!KeBugCheckEx
fffffa05`c3b0f230 fffff805`3b476e08 : 00000000`00000000 00000000`00000000 fffffa05`c3b0f5f0 00000000`00000000 : nt!MiCheckFatalAccessViolation+0x22a6fc
fffffa05`c3b0f270 fffff805`3b4a7672 : 00000000`00000002 ffff8001`00000000 00000000`00000000 ffffb1d8`c0000000 : nt!MiInPagePageTable+0x328
fffffa05`c3b0f440 fffff805`3b4a6ccc : fffffa05`c3b0f610 00000000`00000000 ffffc10f`deef5040 00000000`00000000 : nt!MiResolvePageTablePage+0x1e2
fffffa05`c3b0f4b0 fffff805`3b4a66eb : 00000000`00000000 00000000`00000000 00000000`00000000 ffff8001`5c6fb180 : nt!MiUserFault+0x1ec
fffffa05`c3b0f530 fffff805`3b6250f5 : fffffa05`c3b0f759 fffff805`3b4b1c26 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x13b
fffffa05`c3b0f6d0 fffff805`3b4d154c : 00000000`00000000 fffff805`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x335
fffffa05`c3b0f860 fffff805`3b4d0eb3 : ffffc10f`deecdce0 ffffc10f`f7467000 ffffc10f`00000000 ffffc10f`00000000 : nt!KeRemovePriQueue+0x24c
fffffa05`c3b0f900 fffff805`3b45a8b5 : ffffc10f`f7467040 ffffc10f`f97593f8 ffffc10f`f7467040 00000000`00000000 : nt!ExpWorkerThread+0xd3
fffffa05`c3b0faf0 fffff805`3b61a574 : ffff8001`5c6fb180 ffffc10f`f7467040 fffff805`3b45a860 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffffa05`c3b0fb40 00000000`00000000 : fffffa05`c3b10000 fffffa05`c3b09000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34
SYMBOL_NAME: nt!MiCheckFatalAccessViolation+22a6fc
IMAGE_VERSION: 10.0.22000.556
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: hardware
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {201b0e5d-db2a-63d2-77be-8ce8ff234750}
Followup: MachineOwner
Code:
For analysis of this file, run !analyze -v
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff9041d5bf2e0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff9041d5bf238, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2734
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7085
Key : Analysis.Init.CPU.mSec
Value: 531
Key : Analysis.Init.Elapsed.mSec
Value: 3252
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffff9041d5bf2e0
BUGCHECK_P3: fffff9041d5bf238
BUGCHECK_P4: 0
TRAP_FRAME: fffff9041d5bf2e0 -- (.trap 0xfffff9041d5bf2e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff988bfab1d000 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff988c00688000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802638a0d42 rsp=fffff9041d5bf470 rbp=fffff9041d5bf641
r8=ffff988be4005008 r9=ffff988be4005018 r10=ffff988be6a93000
r11=00000000000000c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!RtlpHpLfhSlotAllocate+0x2205f2:
fffff802`638a0d42 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffff9041d5bf238 -- (.exr 0xfffff9041d5bf238)
ExceptionAddress: fffff802638a0d42 (nt!RtlpHpLfhSlotAllocate+0x00000000002205f2)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MoUsoCoreWorker.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffff904`1d5befb8 fffff802`638290a9 : 00000000`00000139 00000000`00000003 fffff904`1d5bf2e0 fffff904`1d5bf238 : nt!KeBugCheckEx
fffff904`1d5befc0 fffff802`638294f2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff904`1d5bf100 fffff802`638277d2 : ffffa90c`88754ab0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xb2
fffff904`1d5bf2e0 fffff802`638a0d42 : 00000000`00000000 fffff802`63b72cc5 00000000`00000000 00000000`00000001 : nt!KiRaiseSecurityCheckFailure+0x312
fffff904`1d5bf470 fffff802`6367fd23 : ffff988b`e4002380 ffff988b`e4004ec0 ffff988b`e4005000 00000000`000001a0 : nt!RtlpHpLfhSlotAllocate+0x2205f2
fffff904`1d5bf570 fffff802`6367fa2f : ffffffff`00000002 00000000`00000001 ffffa90c`4c506343 ffffffff`800031c0 : nt!ExAllocateHeapPool+0x2a3
fffff904`1d5bf6a0 fffff802`63e6b4ed : 00000000`00000040 00000000`00000001 00000000`00000600 00000000`00000000 : nt!ExpAllocatePoolWithTagFromNode+0x5f
fffff904`1d5bf6f0 fffff802`63bbb515 : 00000000`0000006c fffff904`1d5bf8a0 ffffa90c`88c962c8 ffffa90c`88c97208 : nt!ExAllocatePool2+0xcd
fffff904`1d5bf7a0 fffff802`636d0f2f : ffff988b`e4710bb0 ffff988c`00d1d040 ffff988b`e4710bb0 fffff802`64133680 : nt!PfSnPopulateReadList+0x245
fffff904`1d5bf900 fffff802`6365a8b5 : ffff988c`00d1d040 ffffa90c`82edc3d1 ffff988c`00d1d040 004fa4ef`bd9bbfff : nt!ExpWorkerThread+0x14f
fffff904`1d5bfaf0 fffff802`6381a574 : ffff8681`9f4fb180 ffff988c`00d1d040 fffff802`6365a860 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff904`1d5bfb40 00000000`00000000 : fffff904`1d5c0000 fffff904`1d5b9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34
SYMBOL_NAME: nt!KiFastFailDispatch+b2
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22000.556
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: b2
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
Code:
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8020ed2127a, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8020e624ec9, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2249
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 3867
Key : Analysis.Init.CPU.mSec
Value: 452
Key : Analysis.Init.Elapsed.mSec
Value: 1829
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
BUGCHECK_CODE: a
BUGCHECK_P1: fffff8020ed2127a
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8020e624ec9
READ_ADDRESS: fffff8020ef05450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
fffff8020ed2127a
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: RidersRepublic.exe
TRAP_FRAME: ffffe008267e7850 -- (.trap 0xffffe008267e7850)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000100000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8020e624ec9 rsp=ffffe008267e79e0 rbp=ffffe008267e7a60
r8=00000208dee57ce0 r9=000002099b44ded0 r10=ffffc58eb3cdb080
r11=0000006b252fecf8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz ac po cy
nt!KiPageFault+0x109:
fffff802`0e624ec9 658804257a020000 mov byte ptr gs:[27Ah],al gs:00000000`0000027a=??
Resetting default scope
STACK_TEXT:
ffffe008`267e7708 fffff802`0e6290a9 : 00000000`0000000a fffff802`0ed2127a 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffe008`267e7710 fffff802`0e625200 : 00000000`00000000 fffff802`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffe008`267e7850 fffff802`0e624ec9 : 00007ff6`a2a2a4c0 00000208`27e453b8 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x440
ffffe008`267e79e0 00007ff6`9ffc5e66 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x109
0000006b`252feb78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff6`9ffc5e66
SYMBOL_NAME: nt!KiPageFault+109
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22000.556
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 109
FAILURE_BUCKET_ID: AV_nt!KiPageFault
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ec3e2762-48ae-ffe9-5b16-fbcb853e8320}
Followup: MachineOwner
is this a laptop or a desktop? i ask because you only have one ram module in bank 3
Code:
Location : ChannelB-DIMM1
BankLabel : BANK 3
Manufacturer : Samsung
MemoryType : DDR4
FormFactor : DIMM
Capacity : 8GB
Speed : 2666
Serial : 31375173
PartNumber : M378A1K43DB2-CTD
ECC : False
TypeDetail : {Synchronous}
Test your memory:
Legacy bios - MemTest86+ - Test RAM
UEFI bios - Run Windows Memory Diagnostics Tool in Windows 10
Quote